Search

E-commerce security has recently been an emerging topic due to the escalation in credit card fraud and stolen user accounts. In general, the security bridge and privacy leakage occur on the side of e-commerce companies due to various factors such as flaws in the design of their storage systems. The stored information of users increases the risk on privacy bridge and to remedy such risks e-commerce companies are forced to make costly investments. The security threats also enforce the development of robust security protocols and methods in digital commerce systems. The current protocols and methods generally bring extra communication and computation costs to all parties involving in the e-commerce system and the security risk on the side of e-commerce companies still remains. In this paper, we propose a Secure E-commerce Scheme (SES) which alleviates the security threats on the side of e-commerce companies and reduces communication costs for all parties. The proposed secure e-commerce protocol, SES, is implemented, analyzed and compared to two well-known schemes; Secure Electronic Transaction (SET) and 3D Secure.

Smart home is intended to be able to enhance home automation systems and achieves goals such as reducing operational costs and increasing comfort while providing security to mobile users. However, an attacker may attempt security attacks in smart home environments because he/she can inject, insert, intercept, delete, and modify transmitted messages over an insecure channel. Secure and lightweight authentication protocols are essential to ensure useful services in smart home environments. In 2020, Iqbal et al. presented an anonymous lightweight authentication protocol for software-defined networking (SDN) enabled smart home, called ALAM. They claimed that ALAM protocol could resist security threats, and also provide secure mutual authentication and user anonymity. This comment demonstrates that ALAM protocol is fragile to various attacks, including session key disclosure, impersonation, and man-in-the-middle attacks, and also their scheme cannot provide user anonymity and mutual authentication. We propose the essential security guidelines to overcome the security flaws of ALAM protocol.

The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.

Smart homes are an emerging paradigm of Internet of Things (IoT) in which users can remotely control various home devices via the internet anytime and anywhere. However, smart home environments are vulnerable to security attacks because an attacker can inject, insert, intercept, delete, and modify transmitted messages over an insecure channel. Thus, secure and lightweight authentication protocols are essential to ensure useful services in smart home environments. In 2021, Kaur and Kumar presented a two-factor based user authentication protocol for smart homes using elliptic curve cryptosystems (ECC). Unfortunately, we demonstrate that their scheme cannot resist security attacks such as impersonation and session key disclosure attacks, and also ensure secure user authentication. Moreover, their scheme is not suitable in smart home environments because it utilizes public-key cryptosystems such as ECC. Hence, we design a secure and lightweight three-factor based privacy-preserving authentication scheme for IoT-enabled smart home environments to overcome the security problems of Kaur and Kumar’s protocol. We prove the security of the proposed scheme by using informal and formal security analyses such as the ROR model and AVISPA simulation. In addition, we compare the performance and security features between the proposed scheme and related schemes. The proposed scheme better provides security and efficiency compared with the previous schemes and is more suitable than previous schemes for IoT-enabled smart home environments.

Multi-server technology is widely utilized due to its enormous applicability in fields such as telecare medicine information system (TMIS), online shopping, remote surveillance, online banking, etc. However, a malicious attacker can perform various security attacks in the multi-server environments because he/she can easily modify, insert, inject, delete, and intercept exchanged messages over a public channel. Thus, secure authentication and key agreement (AKA) schemes are indispensable to provide useful services in multi-server environments. In 2020, Ali et al. presented a three-factor symmetric key based secure AKA scheme for privacy and security in multi-server environments. Ali et al. claimed that their scheme can prevent various security attacks, and also ensure secure authentication. However, this comment shows that Ali et al.'s scheme suffers from many drawbacks, including session key exposure, man-in-the-middle (MITM), and masquerade attacks. Moreover, their scheme fails to ensure mutual authentication. Thus, we suggest the necessary security guidelines to resolve the security threats of Ali et al.'s scheme.

For wearable devices, this paper proposes an authentication protocol eWMDP. We formally model and analyze it. In the execution model of the protocol, a Dolev-Yao adversary is constituted. With the above, various security properties can be defined for measuring security performance. Our protocol can achieve the injective-auth property, in which case it surpasses another existing wearable authentication protocol-WMDP. In addition, our analysis work is confirmed by Scyther and tamain-prover, and the two protocols are implemented on PC and on Ti CC3200 LAUNCHPAD widely used in wearable devices in the meanwhile. The results of experiments highlight the higher transmission efficiency of eWMDP under various configurations, including different platforms, sorts of combinations of encryption algorithms and hash algorithms, and sending packets in different sizes.

Providing efficient anonymous authentication in vehicular ad hoc networks (VANETs) is a challenging issue. Identity-based signature schemes have been used to provide privacy-preserving authentication effectively for VANETs. In such scenario, mutual authentication between vehicles is critical to ensure only legitimate vehicles can involve in the inter-vehicle communication, and how to resist denial-of-service attack should be carefully addressed due to the regionally central signature verification in vehicle-road-side communications. In this paper, we propose a conditional privacy-preserving mutual authentication framework with denial-of-service attack resistance called MADAR. The authentication framework combines different identity-based signature schemes and distinguishes inner-region and cross-region authentications to increase efficiency. Beyond the privacy preservation and non-repudiation achieved by the existing framework, our authentication framework provides asymmetric inter-vehicle mutual authentication and strength-alterable computational DoS-attack resistance. We have formally proved the privacy preservation, unlinkability, mutual authenticity, and correctness of pseudonym with ProVerif, and analyzed other security objectives. The performance evaluations are conducted and the results demonstrate that our framework can achieve these security objectives with moderate computation and communication overheads.